summaryrefslogtreecommitdiff
path: root/deps/openssl/openssl/crypto/ec/ecp_nistp521.c
diff options
context:
space:
mode:
Diffstat (limited to 'deps/openssl/openssl/crypto/ec/ecp_nistp521.c')
-rw-r--r--deps/openssl/openssl/crypto/ec/ecp_nistp521.c67
1 files changed, 43 insertions, 24 deletions
diff --git a/deps/openssl/openssl/crypto/ec/ecp_nistp521.c b/deps/openssl/openssl/crypto/ec/ecp_nistp521.c
index 0a82abca1b..14f2feeb69 100644
--- a/deps/openssl/openssl/crypto/ec/ecp_nistp521.c
+++ b/deps/openssl/openssl/crypto/ec/ecp_nistp521.c
@@ -40,12 +40,12 @@ NON_EMPTY_TRANSLATION_UNIT
# include <openssl/err.h>
# include "ec_lcl.h"
-# if defined(__GNUC__) && (__GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 1))
+# if defined(__SIZEOF_INT128__) && __SIZEOF_INT128__==16
/* even with gcc, the typedef won't work for 32-bit platforms */
typedef __uint128_t uint128_t; /* nonstandard; implemented by gcc on 64-bit
* platforms */
# else
-# error "Need GCC 3.1 or later to define type uint128_t"
+# error "Your compiler doesn't appear to support 128-bit integer types"
# endif
typedef uint8_t u8;
@@ -1156,9 +1156,9 @@ static void copy_conditional(felem out, const felem in, limb mask)
* adapted for mixed addition (z2 = 1, or z2 = 0 for the point at infinity).
*
* This function includes a branch for checking whether the two input points
- * are equal (while not equal to the point at infinity). This case never
- * happens during single point multiplication, so there is no timing leak for
- * ECDH or ECDSA signing. */
+ * are equal (while not equal to the point at infinity). See comment below
+ * on constant-time.
+ */
static void point_add(felem x3, felem y3, felem z3,
const felem x1, const felem y1, const felem z1,
const int mixed, const felem x2, const felem y2,
@@ -1252,6 +1252,22 @@ static void point_add(felem x3, felem y3, felem z3,
/* ftmp5[i] < 2^61 */
if (x_equal && y_equal && !z1_is_zero && !z2_is_zero) {
+ /*
+ * This is obviously not constant-time but it will almost-never happen
+ * for ECDH / ECDSA. The case where it can happen is during scalar-mult
+ * where the intermediate value gets very close to the group order.
+ * Since |ec_GFp_nistp_recode_scalar_bits| produces signed digits for
+ * the scalar, it's possible for the intermediate value to be a small
+ * negative multiple of the base point, and for the final signed digit
+ * to be the same value. We believe that this only occurs for the scalar
+ * 1fffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+ * ffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb
+ * 71e913863f7, in that case the penultimate intermediate is -9G and
+ * the final digit is also -9G. Since this only happens for a single
+ * scalar, the timing leak is irrelevent. (Any attacker who wanted to
+ * check whether a secret scalar was that exact value, can already do
+ * so.)
+ */
point_double(x3, y3, z3, x1, y1, z1);
return;
}
@@ -1587,7 +1603,7 @@ static void batch_mul(felem x_out, felem y_out, felem z_out,
/* Precomputation for the group generator. */
struct nistp521_pre_comp_st {
felem g_pre_comp[16][3];
- int references;
+ CRYPTO_REF_COUNT references;
CRYPTO_RWLOCK *lock;
};
@@ -1643,7 +1659,11 @@ const EC_METHOD *EC_GFp_nistp521_method(void)
0, /* keycopy */
0, /* keyfinish */
ecdh_simple_compute_key,
- 0 /* blind_coordinates */
+ 0, /* field_inverse_mod_ord */
+ 0, /* blind_coordinates */
+ 0, /* ladder_pre */
+ 0, /* ladder_step */
+ 0 /* ladder_post */
};
return &ret;
@@ -1654,7 +1674,7 @@ const EC_METHOD *EC_GFp_nistp521_method(void)
* FUNCTIONS TO MANAGE PRECOMPUTATION
*/
-static NISTP521_PRE_COMP *nistp521_pre_comp_new()
+static NISTP521_PRE_COMP *nistp521_pre_comp_new(void)
{
NISTP521_PRE_COMP *ret = OPENSSL_zalloc(sizeof(*ret));
@@ -1678,7 +1698,7 @@ NISTP521_PRE_COMP *EC_nistp521_pre_comp_dup(NISTP521_PRE_COMP *p)
{
int i;
if (p != NULL)
- CRYPTO_atomic_add(&p->references, 1, &i, p->lock);
+ CRYPTO_UP_REF(&p->references, &i, p->lock);
return p;
}
@@ -1689,7 +1709,7 @@ void EC_nistp521_pre_comp_free(NISTP521_PRE_COMP *p)
if (p == NULL)
return;
- CRYPTO_atomic_add(&p->references, -1, &i, p->lock);
+ CRYPTO_DOWN_REF(&p->references, &i, p->lock);
REF_PRINT_COUNT("EC_nistp521", x);
if (i > 0)
return;
@@ -1724,9 +1744,10 @@ int ec_GFp_nistp521_group_set_curve(EC_GROUP *group, const BIGNUM *p,
if ((ctx = new_ctx = BN_CTX_new()) == NULL)
return 0;
BN_CTX_start(ctx);
- if (((curve_p = BN_CTX_get(ctx)) == NULL) ||
- ((curve_a = BN_CTX_get(ctx)) == NULL) ||
- ((curve_b = BN_CTX_get(ctx)) == NULL))
+ curve_p = BN_CTX_get(ctx);
+ curve_a = BN_CTX_get(ctx);
+ curve_b = BN_CTX_get(ctx);
+ if (curve_b == NULL)
goto err;
BN_bin2bn(nistp521_curve_params[0], sizeof(felem_bytearray), curve_p);
BN_bin2bn(nistp521_curve_params[1], sizeof(felem_bytearray), curve_a);
@@ -1834,7 +1855,6 @@ int ec_GFp_nistp521_points_mul(const EC_GROUP *group, EC_POINT *r,
int ret = 0;
int j;
int mixed = 0;
- BN_CTX *new_ctx = NULL;
BIGNUM *x, *y, *z, *tmp_scalar;
felem_bytearray g_secret;
felem_bytearray *secrets = NULL;
@@ -1851,14 +1871,12 @@ int ec_GFp_nistp521_points_mul(const EC_GROUP *group, EC_POINT *r,
const EC_POINT *p = NULL;
const BIGNUM *p_scalar = NULL;
- if (ctx == NULL)
- if ((ctx = new_ctx = BN_CTX_new()) == NULL)
- return 0;
BN_CTX_start(ctx);
- if (((x = BN_CTX_get(ctx)) == NULL) ||
- ((y = BN_CTX_get(ctx)) == NULL) ||
- ((z = BN_CTX_get(ctx)) == NULL) ||
- ((tmp_scalar = BN_CTX_get(ctx)) == NULL))
+ x = BN_CTX_get(ctx);
+ y = BN_CTX_get(ctx);
+ z = BN_CTX_get(ctx);
+ tmp_scalar = BN_CTX_get(ctx);
+ if (tmp_scalar == NULL)
goto err;
if (scalar != NULL) {
@@ -2019,7 +2037,6 @@ int ec_GFp_nistp521_points_mul(const EC_GROUP *group, EC_POINT *r,
err:
BN_CTX_end(ctx);
EC_POINT_free(generator);
- BN_CTX_free(new_ctx);
OPENSSL_free(secrets);
OPENSSL_free(pre_comp);
OPENSSL_free(tmp_felems);
@@ -2042,7 +2059,9 @@ int ec_GFp_nistp521_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
if ((ctx = new_ctx = BN_CTX_new()) == NULL)
return 0;
BN_CTX_start(ctx);
- if (((x = BN_CTX_get(ctx)) == NULL) || ((y = BN_CTX_get(ctx)) == NULL))
+ x = BN_CTX_get(ctx);
+ y = BN_CTX_get(ctx);
+ if (y == NULL)
goto err;
/* get the generator */
if (group->generator == NULL)
@@ -2052,7 +2071,7 @@ int ec_GFp_nistp521_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
goto err;
BN_bin2bn(nistp521_curve_params[3], sizeof(felem_bytearray), x);
BN_bin2bn(nistp521_curve_params[4], sizeof(felem_bytearray), y);
- if (!EC_POINT_set_affine_coordinates_GFp(group, generator, x, y, ctx))
+ if (!EC_POINT_set_affine_coordinates(group, generator, x, y, ctx))
goto err;
if ((pre = nistp521_pre_comp_new()) == NULL)
goto err;
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-12 15:03:10 +0000